Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.
Summary
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus...
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| mvnrepository.comquarkus-resteasy-reactive |
≥ 3.2.0, < 3.2.10.Final→ 3.2.10.Final ≥ 3.6.0, < 3.6.9→ 3.6.9 ≥ 3.7.0, < 3.7.1→ 3.7.1 |
3.2.10.Final 3.6.9 3.7.1 |
| Red HatRed Hat build of Quarkus 2.13.9.Final | — | Not listed |
| Red HatRed Hat build of Quarkus 3.2.9.Final | — | Not listed |
| Red HatA-MQ Clients 2 | — | Not listed |
| Red HatCryostat 2 | — | Not listed |
| Red HatOpenShift Serverless | — | Not listed |
| Red HatRed Hat build of Apicurio Registry 2 | — | Not listed |
| Red HatRed Hat build of OptaPlanner 8 | — | Not listed |
| Red HatRed Hat Fuse 7 | — | Not listed |
| Red HatRed Hat Integration Camel K 1 | — | Not listed |
| Red HatRed Hat Integration Camel Quarkus 2 | — | Not listed |
| Red HatRed Hat JBoss Enterprise Application Platform 8 | — | Not listed |
| Red HatRed Hat Process Automation 7 | — | Not listed |
Original description The description as published by the source.
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties.
Source: CVE.org (CVE Program・cvelistV5) NVD
References
- web access.redhat.com
- web access.redhat.com
- web access.redhat.com
- web bugzilla.redhat.com